Cryptographic systems, or cryptosystems, are composed of several cryptographic primitives, such as algorithms for encryption and decryption (ciphers), one-way hash functions, random number generators, authentication algorithms, digital signatures, and key distribution systems. In general, a cryptosystem is only as secure as its weakest component.
Many conventional encryption schemes that provide secure transmission of data (messages) employ an asymmetric encryption such as public-key encryption (PKE).
PKE schemes, such as the Rivest, Shamir, and Adelman (RSA) algorithm, use two keys, a public key known to everyone and a private or secret key known only to the recipient of the message. When the originator of a message (source) wants to send a secure message to a recipient (destination), the source uses the public key of the destination to encrypt the message. The message is then decrypted using the private key of the destination. For public key digital signatures, the sender signs using his or her private key, and the recipient verifies using the sender's public key.
All PKE schemes are based on the fact that key deduction would require a prohibitive amount of time and processing resources. RSA, for example, is based on the lack of efficient schemes for factoring large numbers. Such schemes were once thought to be highly secure, but are now known to be susceptible under certain conditions. For example, RSA and other PKE schemes are vulnerable to particular cryptanalysis techniques employing quantum computers, such as Shor's Algorithm. The only way to increase the security of an algorithm like RSA would be to increase the key size to ensure that keylength exceeds the storage capacity of any foreseeable quantum computer. Such a scheme is impractical and unreliable, given the efficient scaling of Shor's Algorithm and other quantum computer-based cryptanalysis techniques.
The potential vulnerability of current encryption schemes has increased the interest in the development of systems that provide security against conventional cryptanalysis as well contemplated future cryptanalysis techniques. Systems that provide such “cryptographically strong forward security (CSFS)” will include some common attributes. CSFS systems will not use algorithms that are vulnerable to conventional or quantum cryptanalysis. For example, CSFS systems will not employ PKE due to its vulnerability (e.g., Shor's Algorithm). For CSFS systems implementing symmetric encryption, very high key rates—approaching those of one-time pad (OTP)—will be used. CSFS systems will provide a secure manner for key distribution and employ authentication when necessary to prevent man-in-the-middle (MITM) attacks.
For many applications, providing sufficiently high key rates in a secure manner will require some secure means of ongoing key distribution, since it would be impractical to distribute and store the large numbers of keys upfront. Additionally, preventing conventional cryptanalysis and MITM attacks requires a secure replacement for public key cryptography's role in authentication.
If two parties share a small secret key for authentication, they can use quantum key distribution (QKD) as a means of performing ongoing key distribution in a secure manner (other techniques may also be possible). QKD uses fundamental physical properties of quantum systems to provide secure communications. In contrast to PKE schemes that employ mathematical techniques and rely on the computational difficulty of certain mathematical problems (e.g. integer factorization), QKD is based on principles of quantum mechanics (i.e., measurement of a generic quantum state inherently disturbs the state).
Conventional QKD technology is not widely implemented due to two significant disadvantages, which we term the relay problem and the stranger identification/authentication problem.
The Relay Problem
Presently, QKD suffers limitations on the length of a single QKD link. Multiple links can be concatenated to extend the distance, but, if this is done in a naive way, it exposes the system to compromise if any of the intermediate nodes are corrupt. This is referred to as the “relay problem”. As mentioned above, QKD is a secure key distribution scheme that in one implementation involves transmitting quantum bits while using quantum mechanics to detect eavesdropping (compromised security). QKD provides security between parties who share a small secret key, which is used for authentication. Practically, however, the quantum bits are transmitted using conventional optical transmission means (e.g., fiber optic cable). Such optic transmission means are subject to losses, which limit the transmission distance. That is, due to the attenuation of light through the transmission media, signals have a practical limitation of approximately 100 km. The use of conventional amplifiers or repeaters would distort or destroy the quantum information. The development of efficient quantum repeaters may extend this distance, but such developments are years away and will require quantum memory and other technically complex features. Moreover, quantum repeaters may not extend the transmission distances enough to develop a practical QKD system.
The relay problem has been addressed, theoretically, with multi-party protocols. Such schemes have their own disadvantages in that any disconnection in the transmission path will result in lost or corrupted information. Moreover, such schemes require 100% trust of the parties, which is typically not a practical assumption.
The Stranger Authentication Problem
A second significant disadvantage of conventional encryption systems such as those employing QKD technology is the stranger authentication problem.
In large networks in which public key cryptosystems cannot be relied upon, a special means for authenticating mutual strangers that do not share secret keys is necessary. While this problem could be addressed with a small number of central authentication servers, this requires all users to completely trust the authentication servers, and imposes enormous communications bandwidth and storage requirements on the servers. This is referred to this as the “stranger authentication problem”.
As larger networks implementing CSFS systems are created, it will become increasingly common for parties that do not share a secret key to wish to communicate. Without a shared secret key, such parties cannot authenticate the channel used and are thus vulnerable to “man-in-the-middle” attacks in which an attacker is able to read, insert and modify at will, messages between two communicating parties without either party knowing that the link between them has been compromised.
With these disadvantages, conventional encryption systems including those employing QKD provide only a partial solution to the difficulties posed by the advent of cryptanalysis techniques employing quantum computers.